Mac-Shell-Mcp (< 2.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mac-shell-mcp--2.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 13:43:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-108953: OS Command Injection in mac-shell-mcphttps://feed.craftedsignal.io/briefs/2026-10-mac-shell-mcp-injection/Mon, 12 Oct 2026 13:43:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mac-shell-mcp-injection/The mac-shell-mcp package before version 2.0.0 is vulnerable to OS command injection via malicious prompt manipulation of execute_command arguments, allowing unauthorized code execution.The mac-shell-mcp library, used for Model Context Protocol (MCP) interactions, contains a critical OS command injection vulnerability identified as CVE-2026-108953. This vulnerability exists in versions prior to 2.0.0 and stems from improper sanitization of arguments passed to the execute_command function. MCP clients, which rely on this server component to execute shell commands, can be coerced by malicious prompts to execute unauthorized commands. An attacker can inject shell metacharacters, such as semicolons, into arguments intended for approved commands (e.g., pwd), effectively bypassing the established command whitelist. Successful exploitation results in arbitrary code execution with the permissions of the user running the MCP server process, posing a significant risk in environments where LLMs or external agents interact with local system resources.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the host machine running the mac-shell-mcp server. This can lead to full system compromise, data exfiltration, or the establishment of persistent backdoors depending on the privileges assigned to the user running the service. The vulnerability affects all deployments of mac-shell-mcp version 2.0.0 and earlier.

Recommendation

  • Upgrade mac-shell-mcp to version 2.0.0 or later immediately to patch the vulnerable execute_command input sanitization logic.
  • Review all MCP server implementations for exposure to untrusted user input or external prompt injections that might invoke local shell commands.
  • Ensure the user account running the MCP server has the principle of least privilege applied, restricting its ability to modify system-level files or reach sensitive data.
]]>highadvisoryinjectionrcemcpmac-shell-mcp